An alternative piloting system for integrating in a pre-existing aircraft

ABSTRACT

An alternative piloting system arranged to be integrated in a pre-existing aircraft that includes original systems having flight control and autopilot systems. The autopilot system includes a piloting device independent of the original systems, having a positioning unit arranged to produce positioning data relating to the aircraft, and a control unit arranged to produce an alternative piloting setpoint for the aircraft; an acquisition and analysis device, including acquisition device arranged to acquire data produced by the original systems, positioning data and alternative piloting setpoint as produced by the piloting device, and decision device arranged to decide whether the alternative piloting setpoint should or should not be used for piloting the aircraft; and an interface device arranged to control the flight control system on the basis of the alternative piloting setpoint when the decision device of the acquisition and analysis device decide that said alternative piloting setpoint should be used for piloting the aircraft.

The invention relates to the field of alternative piloting systems forintegrating in pre-existing aircraft.

BACKGROUND OF THE INVENTION

Modern airliners are generally piloted by a crew of at least two pilotscomprising a captain and a co-pilot.

Plans are being made to fly certain such airliners with only one pilotfor very specific applications, and in particular for transportingcargo. Plans are thus being made to convert an Airbus A321 type airlinerinto a cargo plane suitable for being piloted by a single pilot.

Reconfiguring an airliner in this way presents numerous advantages.

By transforming a pre-existing airliner that has already been flying forseveral years into a cargo plane, a time-tested and reliable cargo planeis obtained without any need to finance an entire new airplanedevelopment program. Furthermore, the financial return on the initialprogram is improved by means of this new application.

Since, unlike an airliner, a cargo plane does not transport passengers,reducing the number of pilots would appear to be an initial step that iseasier for the general public to accept. Naturally, there is no questionof accepting any reduction in flight safety, which should not bedegraded, but which should rather be improved by this configuration.

By reducing the number of pilots, the overall cost of each flight isnaturally also reduced.

Furthermore, various solutions have emerged that serve to assist a pilotin piloting tasks, potentially improving safety by being able to analyzea large quantity of data in real time.

Nevertheless, reconfiguring an airliner in this way also encountersvarious difficulties.

Reducing the number of pilots makes it necessary to develop variousadditional safety functions, and to integrate them in the airplane.

These additional safety functions relate in particular to ensuring thatthe airplane continues to be piloted in complete safety even in theevent of a failure of the autopilot system or in the event of the solepilot being incapable of piloting the airplane manually. The additionalsafety functions must also serve to prevent, or at least to limit, theconsequences of a malicious act undertaken by the pilot, such as forexample deliberately crashing of the airplane into infrastructure orpopulated areas.

Naturally, for the conversion of a pre-existing airliner into a cargoplane to be advantageous from an economic point of view, it must bepossible to integrate these additional safety functions in pre-existingairplanes, while requiring only limited additional certificationactivity.

OBJECT OF THE INVENTION

An object of the invention is to convert a conventional pre-existingairplane in reliable and inexpensive manner into an airplane that can bepiloted by a single pilot.

SUMMARY OF THE INVENTION

In order to achieve this object, there is proposed an alternativepiloting system arranged to be integrated in a pre-existing aircraftthat includes original systems comprising a flight control system and anautopilot system, the alternative piloting system comprising:

-   -   a piloting device independent of the original systems,        comprising a positioning unit arranged to produce positioning        data relating to the aircraft, and a control unit arranged to        produce an alternative piloting setpoint for the aircraft;    -   an acquisition and analysis device, comprising acquisition means        arranged to acquire data produced by the original systems and        also the positioning data and the alternative piloting setpoint        as produced by the piloting device, and decision means arranged        to decide whether the alternative piloting setpoint should or        should not be used for piloting the aircraft; and    -   an interface device arranged to control the flight control        system of the aircraft on the basis of the alternative piloting        setpoint when the decision means of the acquisition and analysis        device decide that said alternative piloting setpoint should be        used for piloting the aircraft.

The alternative piloting system is thus for integrating in apre-existing aircraft. In the event of the pilot becoming unavailable orof an outage of the autopilot system, the alternative piloting setpointcan be used to pilot the aircraft. It is thus safe for the aircraft tobe piloted by a single pilot. Furthermore, since the piloting device isindependent of the original systems, and dissimilar from them in termsof the technologies used or in their implementation in the aircraft, thepiloting device cannot be impacted by a failure affecting those originalsystems. This thus ensures, in particular, that the positioning unit canproduce positioning data relating to the aircraft even in the event ofan outage of the original positioning systems (e.g. the pre-existinginertial units of the aircraft).

The alternative piloting system can be integrated in the pre-existingaircraft without modifying the original systems. There is thus no needfor the original systems to be subjected once again to certificationactivity, thereby reducing the cost of integration. Furthermore, theproposed principle of integration relies on the principle of segregatingthe new functions via a high-integrity interface device.

There is also proposed an aircraft including an alternative pilotingsystem of the kind described above.

The invention can be better understood in the light of the followingdescription of a particular, nonlimiting embodiment of the invention.

BRIEF DESCRIPTION OF THE DRAWING

[Sole FIGURE] Reference is made to the accompanying drawing comprising asole FIGURE that shows the alternative piloting system of the invention,together with a plurality of original systems of a pre-existingaircraft.

DETAILED DESCRIPTION OF THE INVENTION

With, reference to the sole FIGURE, the alternative piloting system 1 ofthe invention is for integrating in a pre-existing aircraft. The term“pre-existing aircraft” it is used to mean that, when the aircraft wasdesigned, no provision was made for it to be fitted with the alternativepiloting system 1 of the invention. In other words, at the time it wasdesigned, of the aircraft did not include specific interfaces forintegrating the alternative piloting system 1 of the invention.

The aircraft is an airliner that is to be converted into a cargo planesuitable for being piloted by a single pilot. The alternative pilotingsystem 1 is integrated in the airplane so as to enable it to be pilotedby that single pilot while still complying with the safety and securityrequirements that are applicable to a conventional cargo plane pilotedby a plurality of pilots.

The airplane includes a certain number of original systems, i.e. systemsthat were present at the time the airplane was designed.

These original systems include a flight control system 2, a landing gearsystem 3, a lighting system 4, a communication system 5, an autopilotsystem 6, and a navigation system 7. The landing gear system 3 includesa system for steering at least one undercarriage of the landing gearsystem, enabling the airplane to be steered when it moves on the ground,and also a braking system.

The original systems naturally include systems other than thosementioned above.

All of the original systems comprise equipment that is potentiallyprovided with redundancy, and possibly in triplicate.

The flight control system 2 comprises pedals 8, a pitch control wheel 9,an elevator aileron computer (ELAC) system 10, a spoiler elevatorcomputer (SEC) system 11, a forward air controller (FAC) system 12, anda slat flap control computer (SFCC) system 13.

The undercarriage system 3 includes a braking and steering control unit(BSCU) 15.

The lighting system 4 includes landing lights 16 and lighting controlmeans.

The communication system 5 includes communication means 18 in the veryhigh frequency (VHF) band, communication means 19 in the high-frequency(HF) band, and satellite communication (SATCOM) means 20.

The autopilot system 6 includes a flight management guidance computer(FMGC) system 22 and a full authority digital engine control (FADEC)system 23.

The navigation system 7 includes an air data inertial reference system(ADIRS) 24.

The alternative piloting system 1 co-operates with these originalsystems and with the original avionics, but it is completely separatefrom those original systems and from the original avionics. Theseparation is mechanical separation, software separation, and hardwareseparation. Thus, a failure or an outage of the alternative pilotingsystem 1 (e.g. caused by hacking) has no significant impact on theoriginal systems or on the original avionics.

The alternative piloting system 1 has a plurality of devices and a mainbus 25, which in this example is an ARINC 664 data bus, suitable forconveying commands and data.

The various devices of the alternative piloting system 1 communicatewith one another via the main bus 25. All of the devices of thealternative piloting system 1 are provided with appropriate protectionmeans (firewall, antivirus, etc.) serving to make such communicationsecure.

The devices of the alternative piloting system 1 comprise firstly apiloting device 26. The piloting device 26 is connected solely to themain bus 25. The piloting device 26 is thus totally independent of theoriginal systems of the airplane. The piloting device 26 is connectedsolely to an interface device 34 that is described below, and it is thusalmost completely self-contained.

The piloting device 26 comprises a positioning unit 27 and a controlunit 28.

The positioning unit 27 comprises an inertial measurement unit, asatellite positioning device having one or more antennas, and an airdata computer.

The positioning unit 27 produces positioning data relating to theairplane. The positioning data comprises both location data andorientation data for the airplane.

The positioning unit 27 is independent and self-contained relative tothe original positioning equipment of the airplane, and is different indesign. This imparts dissimilarity between the positioning unit 27 andthe original positioning equipment of the airplane, thus serving inparticular to ensure that a common mode failure does not lead tosimultaneous outages both of the original positioning equipment of theairplane and of the positioning unit 27.

The control unit 28 has two dissimilar calculation channels 28 a and 28b. This serves to avoid a common mode failure leading to simultaneousoutages of both calculation channels 28 a and 28 b.

The control unit 28 is arranged to produce an alternative, pilotingsetpoint for the airplane.

This alternative piloting setpoint is used to pilot the airplane whenthe airplane is in an emergency situation forming part of a predefinedlist of emergency situations. The predefined list of emergencysituations comprises any failure occurring on the airplane, a failure ofthe autopilot system 6 of the airplane, unavailability of the pilot ofthe airplane, and a situation in which the airplane is going towards aprohibited area.

In particular, the control unit 28 hosts emergency pilotingrelationships that are used in the event of the autopilot system of theairplane failing. The emergency piloting relationships serve tostabilize the airplane and to maintain its speed.

The control unit 28 also hosts fail soft piloting relationships.

The fail soft piloting relationships include a relationship formitigating the pilot becoming unavailable while the airplane is takingoff. By way of example, the pilot becoming unavailable may be the resultof the pilot dying suddenly or else becoming physically orpsychologically incapacitated for any reason whatsoever during a flight.

While the airplane is taking off, if the pilot becomes unavailable, itis still possible to interrupt takeoff so long as the speed of theairplane is below a determined speed V1. Once the speed of the airplaneexceeds the determined speed V1, takeoff can no longer be interruptedsince it is too risky to use ground breaking of the airplane at highspeed, and it is then imperative to make the airplane takeoff.

Between the moment when the airplane exceeds the determined speed V1 andthe moment when the aircraft exceeds a determined altitude, e.g. equalto 200 feet, it is normally the pilot who pilots the airplane in manualmode.

Thus, when it is detected that the pilot is unavailable during thisperiod, which lasts for several seconds, typically six seconds, it isthe alternative piloting system 1 that takes over from the pilot andthat manages takeoff. Thereafter, the autopilot system 6 takes over fromthe alternative piloting system 1.

In the event of the pilot being unavailable, the control unit 28 alsohosts emergency flight plans. Thus, if the pilot is unavailable, thealternative piloting system 1 causes the airplane to go to an airportwhere it can land.

The control unit 28 may also produce the alternative piloting setpointso as to avoid the airplane penetrating into predefined prohibitedareas. The alternative piloting setpoint serves to give the airplane apath that no longer leads to the airplane penetrating into Predefinedprohibited areas. By way of example, a predefined prohibited area is anarea containing particular infrastructure (e.g. a nuclear powerstation), an area of high population density, etc.

The control unit 28 continuously calculates the future path of theairplane while making use of the positioning data produced by thepositioning unit 27, and it estimates whether the future path interfereswith a prohibited area. In the event of the pilot going towards aprohibited area, whether because the pilot is unavailable, or becausethe pilot seeks to crash the airplane deliberately, the alternativepiloting setpoint produced by the alternative piloting system 1 is usedto pilot the airplane and to prevent it from penetrating into theprohibited area. If necessary, the alternative piloting setpoint causesthe airplane to crash in an unpopulated area. This performs a“geofencing” function: The position of the airplane is monitored in realtime, and if the airplane is going towards a prohibited area, action istaken on its flightpath to prevent the airplane from penetrating intothe prohibited area.

The control unit 21 thus makes use of relationships for guiding acontrolled crash and also of an algorithm for detecting the loss of thegeofencing function.

The control unit 28 hosts the geographical coordinates of prohibitedareas.

The alternative piloting system 1 also includes an acquisition andanalysis device 30. The acquisition and analysis device 30 is connectedto the main bus 25, and also to the flight control system 2, to thelanding gear system 3, to the lighting system 4, to the communicationsystem 5, and to the autopilot system 6, via secondary buses 31, whichin this example are A429 buses.

The acquisition and analysis device 30 comprises acquisition means 32and analysis means 33.

The acquisition means 32 include a plurality of interfaces with theoriginal systems and a plurality of interfaces with the main bus 25.

The acquisition means 32 acquire data produced by the original systemsof the airplane together with the positioning data and the alternativepiloting setpoint produced by the piloting device 26.

The data produced by the original systems of the airplane and acquiredby the acquisition and analysis device 30 comprises airplane positiondata, attitude data, parameters produced by the autopilot system 6,parameters produced by the flight control system 2, engine parameters,navigation data, failure data, etc.

The analysis means 33 of the acquisition and analysis device 30 processand analyze all of this data. The analysis means 33 detectinconsistencies, if any, in this data.

The analysis means 33 prepare the data for transmitting it to the ground(sorting, formatting, etc.). The analysis means 33 also host a statemachine that serves to support the pilot (cross checks, additional pilotactions), and also to trigger emergency procedures or to allow commandsissued by the piloting device 26 to be taken into account.

On the basis of all this data, on the basis of the alternative pilotingsetpoint, and on the basis of the results of its own processing andanalyses, the acquisition and analysis device 30 decides whether or notthe alternative piloting setpoint should be used for piloting theairplane. The acquisition means 32 of the acquisition and analysisdevice 30 acquire the alternative piloting setpoint, a manual pilotingsetpoint produced by the pilot of the airplane, and an automaticpiloting setpoint produced by the autopilot system 6. The analysis means33 analyze these piloting setpoints in order to decide, on the basis ofthis analysis, whether the alternative piloting setpoint should orshould not be used for piloting the aircraft.

A first example of analysis is mentioned above in this description.While the airplane is taking off, there is a short period during whichthe airplane is normally piloted manually by the pilot. If it isdetected that the pilot is unavailable, the analysis means 33 of theacquisition and analysis device 30 decide that the alternative pilotingsetpoint produced by the alternative piloting system 1 should be usedfor piloting the aircraft. Thereafter, following this short period, theanalysis means 33 of the acquisition and analysis device 30 decide thatthe alternative piloting setpoint should no longer be used for pilotingthe airplane. The autopilot system 6 thus takes over from thealternative piloting system 1 in order to land the airplane safely.

A second example of selecting of the priority setpoint is as follows.

If a manual piloting setpoint as produced by the pilot is tending tomake the aircraft go towards a predefined prohibited area, the analysismeans of the acquisition and analysis device 30 decide that thealternative piloting setpoint produced by the alternative pilotingsystem 1 should be used to pilot the airplane. The airplane and thenperforms a maneuver enabling it to avoid penetrating into the prohibitedarea.

Thereafter, following this maneuver, the analysis means 33 decide thatthe alternative piloting setpoint should no longer be used for pilotingthe airplane: the acquisition and analysis device 30 returns control tothe autopilot system 6 after the alternative piloting system 1 hasperformed the maneuver.

A third example of selecting of the priority setpoint is as follows.

By analyzing airplane parameters (for example analyzing engine setpointsand setpoints for the flight control surfaces), the acquisition andanalysis device 30 is also capable of detecting a failure situationhaving an impact on the airplane. If the airplane is being piloted bythe autopilot system 6 and if the failure is likely to have an impact onthe autopilot system 6, the acquisition and analysis device 30 decidesthat the alternative piloting setpoint should be used for piloting theairplane and engages an emergency piloting mode.

The alternative piloting system 1 also includes an interface device 34.

The interface device 34 is connected to the main bus 25, and also to theflight control system 2, to the landing gear system 3, to the lightingsystem 4, to the communication system 5, and to the autopilot system 6,via secondary buses 35, which in this example are A429 buses.

The interface device 34 comprises switch means. The switch means arecontrolled by the decision means 33 of the acquisition and analysisdevice 30. When the decision means 30 decide that the alternativepiloting setpoint is to be used for piloting the airplane, the decisionmeans control of the switch means to connect an output of the pilotingdevice 26 to the flight control system 2.

The interface device 34 thus applies the alternative piloting setpointas produced by the piloting device 26 when the acquisition and analysisdevice 30 decide that that is the setpoint that is to be used.

The interface device 34 provides the physical interface for activatingairplane controls: flight controls, landing gear, flaps, breakers, etc .. . .

The alternative piloting system 1 further includes a communicationdevice 37 that comprises a secure data module (DM) 38, an air dataterminal (ADT) module 39, and a C2link module 48.

These modules form interface means with a remote piloting system,communication means with remote control, and data security means servingto ensure the integrity of recorded information. Integrity relies inparticular on making secure the recorded data and the commands by usingthe principles implemented in a safety checker.

The communication device 37 is connected to the main bus 25 via the ADTmodule 39, and also to the communication system 5 via secondary buses41, which in this example are A429 buses. The communication device 37 isconnected to the acquisition and analysis device 30 by a serial link.

The communication device 37 enables the airplane to be remotelycontrolled. In particular, the communication device 37 serves toestablish communication with the ground, so that the alternativepiloting system 1 can be controlled from the ground. Thus, in the eventof the pilot being unavailable, for example, radio communication andcontrol of the airplane can be managed from the ground.

The communications performed by the communication device 37 between theairplane and the ground may take place over direct (line of sight) radiolinks, over satellite links, or indeed using ground radio communicationinfrastructure (e.g. 4G or 5G type mobile telephone networks).

The alternative piloting system 1 also includes a taxiing control device45 that comprises a taxi assistance system (TAS) module 46, a guidedevice 47 capable of using one or more cameras and of performing imageprocessing, and an anti-collision device 48, e.g. making use of radarand potentially also of a camera imaging device (daylight, longwavelength infrared (LWIR)).

The taxiing control device 45 is connected externally to the main bus25.

The taxiing control device 45 is suitable for producing a pilotingsetpoint for the airplane on the ground. In the event of the pilot beingincapacitated before the airplane reaches the determined speed V1 duringtakeoff (as explained above in this description), the taxiing controldevice 45 is suitable for braking the airplane, and it also serves tokeep the airplane on the axis of the runway under such conditions. Thetaxiing control device might also perform taxiing, taking the place ofthe pilot.

The alternative piloting system 1 also has a power supply device 49including an uninterruptible power supply. The power supply device 49 isa self-contained and independent device that powers the alternativepiloting system 1 even in the event of a failure having an impact on thepower generation systems of the airplane. The power supply device 49 isconnected to the other devices of the alternative piloting device 1 byindependent power buses.

The alternative piloting system 1 also includes a system monitoringdevice 50 for monitoring the airplane.

The system monitoring device 50 includes a screen located in thecockpit.

The system monitoring device 50 is connected to the main bus 25.

The alternative piloting system 1 also includes a pilot monitoringdevice 51. The pilot monitoring device 51 is used for detecting that theairplane is in the emergency situation corresponding to the pilot beingunavailable.

The pilot monitoring device 51 includes a camera for acquiring images ofthe pilot's face, and in particular of the pilot's eyes.

The pilot monitoring device 51 also includes a detector system capable,in less than two seconds, of detecting that the pilot is incapacitated,by using biometric sensors and specific sensors. The detection systemrequests the pilot to perform a continuous and deliberate action duringthe critical stage of takeoff. The specific sensors used for thispurpose by the detection system may be pushbuttons arranged on thecontrol column and on the throttle that need to be pressed duringtakeoff, or indeed optical sensors that serve to verify that the pilot'shands are indeed on the controls.

The pilot monitoring device 51 is connected to the main bus 25.

The alternative piloting system 1 also includes a virtual co-pilotdevice 52. The purpose of the virtual co-pilot device 52 is toanticipate risky situations and to warn the pilot in the event of suchsituations becoming likely to occur. Also (and above all) the virtualco-pilot device 52 has the purpose of making cross checks between thedata and critical actions, and also of performing tasks in automaticmanner. It, also has a voice interface with the pilot, and a visualinterface. It also generates audio messages. It is made up of a statemachine portion, of a processor module, and of a man machine interface(NMI) portion.

The virtual co-pilot device 52 is connected to the main bus 25.

Naturally, the invention is not limited to the embodiment described, butcovers any variant coming within the ambit of the invention as definedby the claims.

1. An alternative piloting system arranged to be integrated in apre-existing aircraft that includes original systems comprising a flightcontrol system and an autopilot system, the alternative piloting systemcomprising: a piloting device independent of the original systems,comprising a positioning unit arranged to produce positioning datarelating to the aircraft, and a control unit arranged to produce analternative piloting setpoint for the aircraft; an acquisition andanalysis device, comprising acquisition means arranged to acquire dataproduced by the original systems and also the positioning data and thealternative piloting setpoint as produced by the piloting device, anddecision means arranged to decide whether the alternative pilotingsetpoint should or should not be used for piloting the aircraft; and aninterface device arranged to control the flight control system of theaircraft on the basis of the alternative piloting setpoint when thedecision means of the acquisition and analysis device decide that saidalternative piloting setpoint should be used for piloting the aircraft.2. The alternative piloting system according to claim 1, the pilotingdevice being arranged to produce the alternative piloting setpoint insuch a manner that the aircraft follows a path serving to avoid theaircraft penetrating into a predefined prohibited area.
 3. Thealternative piloting system according to claim 1, further comprising amain bus, the piloting device, the acquisition and analysis device, andthe interface device being arranged to be connected to the main bus andto communicate with one another via the main bus.
 4. The alternativepiloting system according to claim 3, wherein the piloting device isconnected solely to the main bus.
 5. The alternative piloting systemaccording to claim 1, the alternative piloting system being arranged topilot the aircraft when the aircraft is in an emergency situationforming part of a predefined list of emergency situations, thepredefined list comprising a failure of the autopilot system,unavailability of the pilot of the aircraft, and a situation in whichthe aircraft is going towards a prohibited area.
 6. The alternativepiloting system according to claim 5, wherein the acquisition means ofthe acquisition and analysis device are arranged to acquire thealternative piloting setpoint, a manual piloting setpoint produced bythe pilot, and an automatic piloting setpoint produced by the autopilotsystem, and wherein the decision means of the acquisition and analysisdevice are arranged to analyze these piloting setpoints and, on thebasis of this analysis, to decide whether the alternative pilotingsetpoint should or should not be used for piloting the aircraft.
 7. Thealternative piloting system according to claim 6, wherein if a manualpiloting setpoint is tending to cause the aircraft to go towards aprohibited area, the decision means of the acquisition and analysisdevice are arranged to decide that the alternative piloting setpointshould be used for piloting the aircraft so that the aircraft performs amaneuver enabling it to avoid penetrating into the prohibited area. 8.The alternative piloting system according to claim 7, wherein afterperforming the maneuver, the acquisition and analysis device is arrangedto decide that the alternative piloting setpoint should no longer beused for piloting the aircraft, with the automatic piloting setpointbeing used instead of the alternative piloting setpoint.
 9. Thealternative piloting system according to claim 6, wherein if a pilot ofthe aircraft becomes unavailable during a takeoff stage that is normallymanaged via a manual piloting setpoint, the acquisition and analysisdevice is arranged to decide that the alternative piloting setpointshould be used for piloting the aircraft during said takeoff stage. 10.The alternative piloting system according to claim 1, further comprisinga communication device arranged to set up communication with the ground,so as to enable the alternative piloting system to be remotelycontrolled from the ground.
 11. The alternative piloting systemaccording to claim 1, further comprising a taxiing control devicearranged to produce an alternative taxiing setpoint for the aircraft.12. The alternative piloting system according to claim 1, wherein thepositioning unit of the piloting device comprises an inertialmeasurement unit, a satellite positioning device including at least oneantenna, and an air data computer, and wherein the control unitcomprises two dissimilar calculation channels.
 13. The alternativepiloting system according to claim 1, wherein the interface deviceincludes switch means controlled by the decision means of theacquisition and analysis device and arranged to connect an output of thepiloting device to the flight control system when the alternativepiloting setpoint should be used for piloting the aircraft.
 14. Anaircraft including an alternative piloting system according to claim 1.